Implement licensing infrastructure (Pro tier gate for SSO, RBAC, integrations)

[dariusvorster]

Context

docs/design/licensing.md defines a Pro tier gating SSO, multi-user RBAC, multiple alert channels, integration tokens, etc. The design exists but no implementation. Several V1 features that should be Pro-gated are currently free (SSO via #187, RBAC via #165, integration tokens, etc.)

Goal

1. License key generation + signing infrastructure
2. License validation library (offline, no phone-home)
3. Feature flag system that reads tier from license
4. Apply gates to: SSO, multi-user RBAC, multiple alert channels, integration tokens, configurable audit retention beyond 30 days
5. UI for entering license at /settings/license

Specs already in design doc.